Claims 

[cl ] 1 . A data processing system-implemented method of tracking movement 

between network addresses comprising: 

receiving a first frame identifier and a first network address at a first time; 
finding a record including the first frame identifier, a second network 
address, and a second time, wherein the second time precedes the first time; 
and 

generating an entry for a table that includes the first frame identifier, the 
first network address, the second network address, and a third time. 

[c2] 2. The method of claim 1 , wherein the first time and the third time are 

substantially a same time. 

[c3] 3. The method of claim 1 , further comprising sending a view to a user before 

receiving the first frame and the first network address, wherein the view 
includes the first frame and a second frame having a second frame identifier. 

[c4] 4. The method of claim 3, further comprising generating a node diagram 

illustrating a sequence of network addresses that originated from the first 
frame but not the second frame. 

[c5] 5. The method of claim 1 , further comprising, in response to receiving, 

sending a view corresponding to the first network address to a computer 
that requested the first network address. 



[c6] 



6. The method of claim 1 , further comprising generating a statement of 
activity, wherein: 

the first network address is significantly owned or controlled by a first party; 
the second network address is significantly owned or controlled by a second 
party; 

the first party is not significantly owned or controlled by the second party, 
and the second party is not significantly owned or controlled by the first 
party; and 

the statement indicates that a user activated the second network address 
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from the first network address. 



[c7] 7. The method of claim 1 , wherein: 

receiving further comprises receiving a user identifier; and 

the second time is closest in time to the first time for the user identifier and 

frame identifier. 

[c8] 8. A data processing system-implemented method of tracking movement 

between network addresses comprising: 

displaying a first view to a user, wherein the first view includes a first frame 
having a first frame identifier and a second frame having a second frame 
identifier; 

receiving a first request for a first network address from the user, wherein 
the first request is generated by the user activating a first object within the 
first frame; 

sending the first frame identifier and the first network address at a first time; 
finding a record including the first frame identifier, a second network 
address, and a second time, wherein, for the first frame identifier, the 
second time precedes the first time; and 

generating a first entry for a table that includes the first frame identifier, the 
first network address, the second network address, and a third time. 

[c9] 9. The method of claim 8, wherein the first time and the third time are 

substantially a same time. 

[cl 0] 1 0. The method of claim 8, further comprising displaying a second view 

corresponding to the first network address to the user. 

[cl 1] 11. The method of claim 8, wherein the second time is closest in time to the 

first time for the first frame identifier. 



[cl2] 



1 2. The method of claim 8, further comprising: 
receiving a second request for a third network address from the user, 
wherein the second request is generated by the user activating a second 
object within the second frame; 
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sending the second frame identifier and the third network address at a 
fourth time; 

finding a record having the second frame identifier, a fourth network 
address, and a fifth time, wherein, for the second frame identifier, the fifth 
time precedes and is closest in time to the fourth time; and 
generating a second entry for the table that includes the second frame 
identifier, the third network address, the fourth network address, and a sixth 
time. 

[cl 3] 1 3. A data processing system readable medium having code embodied 

therein, the code including instructions executable by a data processing 
system, wherein the instructions are configured to cause the data processing 
system to perform a method of tracking movement between network 
addresses, the method comprising: 

receiving a first frame identifier and a first network address at a first time; 
finding a record including the first frame identifier, a second network 
address, and a second time, wherein the second time precedes the first time; 
and 

generating an entry for a table that includes the first frame identifier, the 
first network address, the second network address, and a third time. 

[cl 4] 1 4. The data processing system readable medium of claim 1 3, wherein the 

first time and the third time are substantially a same time. 

[cl 5] 15. The data processing system readable medium of claim 1 3, wherein the 

method further comprises sending a view to a user before receiving the first 
frame and the first network address, wherein the view includes the first 
frame and a second frame having a second frame identifier. 

[ cl 6] 1 6. The data processing system readable medium of claim 1 5, wherein the 

method further comprises generating a node diagram illustrating a sequence 
of network addresses that originated from the first frame but not the second 
frame. 
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[cl 7] 1 7. The data processing system readable medium of claim 1 3, wherein the 

method further comprises, in response to receiving, sending a view 
corresponding to the first network address to a computer that requested the 
first network address. 

[cl 8] 1 8. The data processing system readable medium of claim 1 3, wherein the 

method further comprises generating a statement of activity, wherein: 
the first network address is significantly owned or controlled by a first party; 
the second network address is significantly owned or controlled by a second 
party; 

the first party is not significantly owned or controlled by the second party, 
and the second party is not significantly owned or controlled by the first 
party; and 

the statement indicates that a user activated the second network address 
from the first network address. 

[cl 9] 1 9. The data processing system readable medium of claim 1 3, wherein: 

receiving further comprises receiving a user identifier; and 
the second time is closest in time to the first time for the user identifier and 
frame identifier. 

[c20] 

20. A data processing system readable medium having code embodied 
therein, the code including instructions executable by a data processing 
system, wherein the instructions are configured to cause the data processing 
system to perform a method of tracking movement between network 
addresses, the method comprising: 

displaying a first view to a user, wherein the first view includes a first frame 
having a first frame identifier and a second frame having a second frame 
identifier; 

receiving a first request for a first network address from the user, wherein 
the first request is generated by the user activating a first object within the 
first frame; 

sending the first frame identifier and the first network address at a first time; 
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finding a record including the first frame identifier, a second network 
address, and a second time, wherein, for the first frame identifier, the 
second time precedes the first time; and 

generating a first entry for a table that includes the first frame identifier, the 
first network address, the second network address, and a third time. 

[c21] 21. The data processing system readable medium of claim 20, wherein the 

first time and the third time are substantially a same time. 

[c22] 22. The data processing system readable medium of claim 20, further 

comprising displaying a second view corresponding to the first network 
address to the user. 

[c23] 23. The data processing system readable medium of claim 20, wherein the 

second time is closest in time to the first time for the first frame identifier. 

[c24] 24. The data processing system readable medium of claim 20, further 

comprising: 

receiving a second request for a third network address from the user, 
wherein the second request is generated by the user activating a second 
object within the second frame; 

sending the second frame identifier and the third network address at a 
fourth time; 

finding a record having the second frame identifier, a fourth network 
address, and a fifth time, wherein, for the second frame identifier, the fifth 
time precedes and is closest in time to the fourth time; and 
generating a second entry for the table that includes the second frame 
identifier, the third network address, the fourth network address, and a sixth 
time. 



Page 16 of 23 



